holden093 7c3c4db8db fix(oidc): address RaresKeY review — bootstrap gating and UserInfo sub protection ... 1. Suppress first-user bootstrap admin when OIDC_ADMIN_GROUPS is configured — a non-admin IdP user must not get admin just by being the first to log in. Group membership is the only path when groups are set. 2. Reject mismatched UserInfo sub: the UserInfo endpoint MUST NOT overwrite the verified id_token subject. Also guard all verified identity claims (sub, iss, aud, exp, iat, nonce, azp) from being overwritten by UserInfo.		2026-07-25 18:32:56 +02:00
..
__init__.py	Odysseus v1.0	2026-05-31 23:58:26 +09:00
atomic_io.py	Reject non-string atomic text writes (#1819)	2026-06-29 14:36:21 +01:00
auth.py	fix(oidc): address RaresKeY review — bootstrap gating and UserInfo sub protection	2026-07-25 18:32:56 +02:00
constants.py	refactor(constants): single source of truth for data dir (#3368)	2026-06-08 09:58:52 +02:00
database.py	fix(db): restrict data/app.db to 0600 (#4420)	2026-07-11 21:15:49 +02:00
exceptions.py	refactor(exceptions): dedupe src/exceptions via core re-export (#4785)	2026-06-24 16:50:07 +02:00
log_safety.py	fix(security): redact credential-bearing URLs and PII from logs (#4750)	2026-06-22 23:12:39 +02:00
middleware.py	Show thumbnails on past research cards	2026-06-30 08:00:01 +00:00
models.py	fix: session context drifting — messages leaking between chats (#135) (#267)	2026-06-09 14:12:52 +01:00
oidc.py	fix(oidc): address RaresKeY review — bootstrap gating and UserInfo sub protection	2026-07-25 18:32:56 +02:00
platform_compat.py	fix(platform): read proc version with utf-8	2026-06-11 21:58:22 +01:00
session_manager.py	Merge verified Odysseus fixes	2026-07-23 14:49:02 +00:00